Proposing the ‘Signature’ Auth Scheme: More Usable AND Secure Than Status Quo
summary
Proposes replacing password hashing with request-level digital signatures so the browser extension signs each HTTP request using 256-bit private keys and the server recovers the public address from message+signature instead of storing secrets. Uses existing browser extensions (e.g. metamask) or hardware keystores as password managers, claims phishing resistance and shared identity without emails, and reports the prototype works in production and “feels fast,” with minor open‑source tweaks suggested for standardization.
AI-written summary · about
related talks
23mHTTP Message Signatures Demystified: Stronger Security for JavaScript
55mYou Shall Not Password: Modern Authentication for Web Apps
23mOur future without passwords
16mThe end of forgotten passwords - Biometric Authentication
47mThe state of passwordless auth on the web
21mPasswords are so 1990
40m Authentication is Broken. Can We Try Fix It?
27mSay Goodbye to Passwords and Hello to WebAuthn